agents-city 0.5.1 → 0.5.3

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "city",
       "source": "./plugin",
-      "version": "0.5.1",
+      "version": "0.5.3",
       "description": "Operate one autonomous city seat, its domain, role, repo support agents, goal, recognised skills and explicit roads to other cities."
     }
   ]

package/bin/navegador.mjs

@@ -553,6 +553,114 @@ async function main() {
       JSON.stringify(demo?.dice),
     );
 
+    // Building a house for real: type a name, press the button, get a house.
+    //
+    // The suite used to open this form, check its fields existed and press
+    // Escape — so the one thing it is FOR was never exercised. What that hid:
+    // the roles list arrives a few hundred milliseconds after the form opens,
+    // the form repainted when it did, and the repaint redrew the name field
+    // from a state that had never been told what was typed in it. Typing while
+    // that answer was in flight lost the name, and then the button said to
+    // give it one. Intermittent, which is the worst kind.
+    //
+    // So this types IMMEDIATELY, before the roles can land, which is exactly
+    // what a person does.
+    const construida = await cdp.evalua(`(async () => {
+      const espera = async (sel, n = 40) => {
+        for (let i = 0; i < n; i++) {
+          const el = document.querySelector(sel);
+          if (el) return el;
+          await new Promise(r => setTimeout(r, 250));
+        }
+        return null;
+      };
+      const ir = [...document.querySelectorAll('nav li')].find(l => /houses|casas/i.test(l.textContent));
+      ir?.click();
+      await new Promise(r => setTimeout(r, 600));
+      document.getElementById('altaAgente')?.click();
+      const campo = await espera('.dlgFondo #bvNombre');
+      if (!campo) return { falta: true };
+      // Straight away: the roles request is still in flight right now.
+      campo.value = 'urgencias';
+      campo.dispatchEvent(new Event('input', { bubbles: true }));
+      // Long enough for that answer to land and do whatever it does.
+      await new Promise(r => setTimeout(r, 1500));
+      const sobrevive = (document.querySelector('.dlgFondo #bvNombre') || {}).value;
+      const boton = document.querySelector('.dlgFondo [data-dlg="si"]');
+      boton?.click();
+      const leeNombres = () =>
+        [...document.querySelectorAll('.fichaRPG h3')].map(h => h.textContent.trim());
+      // Wait for the house, not for a guess at how long building takes. A
+      // fixed sleep here made this check itself flaky, which is the one thing
+      // a check for a flaky bug must not be.
+      let nombres = [];
+      for (let i = 0; i < 60; i++) {
+        nombres = leeNombres();
+        if (!document.querySelector('.dlgFondo') && nombres.includes('urgencias')) break;
+        await new Promise(r => setTimeout(r, 250));
+      }
+      return { sobrevive, cerrado: !document.querySelector('.dlgFondo'), nombres };
+    })()`);
+    comprueba(
+      'a name typed while the roles are still loading is still there afterwards',
+      construida?.sobrevive === 'urgencias',
+      JSON.stringify(construida),
+    );
+    comprueba(
+      'and pressing build actually builds the house',
+      !!construida?.cerrado && (construida?.nombres ?? []).includes('urgencias'),
+      JSON.stringify(construida),
+    );
+
+    // And the other half: pressing build with nothing in the name.
+    //
+    // The failure this guards is not "it refuses" — it is refusing SILENTLY, or
+    // refusing while closing the dialog, which loses everything the person had
+    // already chosen. That is the same complaint from the other side: a form
+    // that says no and takes the work with it.
+    const vacia = await cdp.evalua(`(async () => {
+      const espera = async (sel, n = 40) => {
+        for (let i = 0; i < n; i++) {
+          const el = document.querySelector(sel);
+          if (el) return el;
+          await new Promise(r => setTimeout(r, 250));
+        }
+        return null;
+      };
+      const antes = document.querySelectorAll('.fichaRPG h3').length;
+      document.getElementById('altaAgente')?.click();
+      const campo = await espera('.dlgFondo #bvNombre');
+      if (!campo) return { falta: true };
+      // Choose something first: whatever it says, this must not be thrown away.
+      document.querySelector('.dlgFondo [data-bv=\"clase\"][data-id=\"knowledge\"]')?.click();
+      await new Promise(r => setTimeout(r, 300));
+      document.querySelector('.dlgFondo [data-dlg=\"si\"]')?.click();
+      await new Promise(r => setTimeout(r, 1200));
+      const caja = document.querySelector('.dlgFondo');
+      const elegida = !!document.querySelector('.dlgFondo .bvOpcion.elegida[data-id=\"knowledge\"]');
+      const aviso = document.querySelector('#aviso,.aviso,.toast');
+      const fuera = {
+        sigueAbierto: !!caja,
+        elegida,
+        dice: (aviso?.textContent ?? '').trim().slice(0, 80),
+        despues: document.querySelectorAll('.fichaRPG h3').length,
+        antes,
+      };
+      document.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true }));
+      await new Promise(r => setTimeout(r, 200));
+      return fuera;
+    })()`);
+    comprueba(
+      'building with no name refuses without closing the form',
+      !!vacia && !vacia.falta && vacia.sigueAbierto === true,
+      JSON.stringify(vacia),
+    );
+    comprueba(
+      'and keeps what was already chosen, and builds nothing',
+      !!vacia?.elegida && vacia?.despues === vacia?.antes,
+      JSON.stringify(vacia),
+    );
+
     // Spanish and English, on a switch. The READMEs shipped bilingual and the
     // product did not; a language button that does not actually change the page
     // is worse than none at all.

package/bin/serve.py

@@ -29,6 +29,7 @@ import stat
 import subprocess
 import sys
 import threading
+import time
 import urllib.parse
 import webbrowser
 
@@ -44,6 +45,7 @@ import parcels  # noqa: E402
 import units  # noqa: E402
 import busca  # noqa: E402  the disk scanner, and the one list of where work lives
 import cities  # noqa: E402
+import diario  # noqa: E402  what happened, written down
 import demos  # noqa: E402  the recorded demos the Hall plays back
 import roads  # noqa: E402
 import reception  # noqa: E402
@@ -523,6 +525,15 @@ def actividad_viva(datos):
         return {"online": False, "url": "", "city": "", "started_at": ""}
 
 
+def _resumen_cuerpo(cuerpo):
+    """On success, the shape rather than the content: which fields arrived and
+    how long each was. A log that repeats every goal somebody types is a log
+    they will not send anywhere."""
+    if not isinstance(cuerpo, dict):
+        return {}
+    return {k: (len(v) if isinstance(v, (str, list)) else v) for k, v in cuerpo.items()}
+
+
 def _que_es_git(ruta):
     """`repo`, `worktree`, or nothing. A label on a row, never a filter: the
     picker shows every folder and lets the person decide which one matters."""
@@ -603,7 +614,44 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         if os.environ.get("CITY_SETUP_DEBUG"):
             sys.stderr.write("  %s\n" % (format % args))
 
+    #: What this handler last answered, so the request log can say so without
+    #: every endpoint having to report for itself.
+    _ultimo = None
+    _error = None
+
+    def _ciudad_para_apuntar(self, q):
+        """The same city `ciudad` would resolve, resolved without touching it.
+
+        `ciudad` calls `asegura_metadata`, which does `makedirs` and writes
+        `city.yml` — right when a request is about to act on a city, and wrong
+        when the only reason we are asking is to write a log line. The journal
+        runs AFTER the handler, so on a request that archived or reset a city it
+        recreated the very folder that had just been taken away, leaving a ghost
+        behind. Observing something must not create it.
+        """
+        pedida = q.get("city", [""])[0]
+        if pedida:
+            resuelta = self.resuelve_conocida(pedida)
+            if resuelta:
+                return resuelta
+        return seat.donde_viven_las_fichas()
+
+    def apunta(self, q, tipo, **campos):
+        """One journal line, in the journal of the city the request acted on.
+
+        Not the selected one: a request carries `?city=`, and writing its line
+        into whichever city happened to be current put the record of what
+        happened to one city in another city's file. Which is worse than no
+        record, because it is a record that lies about where.
+        """
+        try:
+            diario.apunta(self._ciudad_para_apuntar(q), tipo, **campos)
+        except Exception:  # noqa: BLE001  logging must not break the request
+            pass
+
     def responde(self, cuerpo, tipo="application/json", codigo=200):
+        self._ultimo = codigo
+        self._error = cuerpo.get("error") if isinstance(cuerpo, dict) else None
         if not isinstance(cuerpo, bytes):
             cuerpo = json.dumps(cuerpo).encode()
         self.send_response(codigo)
@@ -690,6 +738,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         "/api/instrucciones": "g_instrucciones",
         "/api/live": "g_live",
         "/api/carpeta": "g_carpeta",
+        "/api/diario": "g_diario",
         "/api/demos": "g_demos",
         "/api/domains": "g_domains",
         "/api/roles": "g_roles",
@@ -707,6 +756,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         "/api/roads": "p_roads",
         "/api/reception": "p_reception",
         "/api/agente": "p_agente",
+        "/api/diario": "p_diario",
         "/api/agentes": "p_agentes",
         "/api/montaje": "p_montaje",
         "/api/motor": "p_motor",
@@ -759,9 +809,24 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             cuerpo = json.loads(self.rfile.read(largo) or b"{}")
         except (ValueError, json.JSONDecodeError) as e:
             return self.responde({"error": f"unreadable body: {e}"}, codigo=400)
-        if ruta in self.POSTS:
-            return getattr(self, self.POSTS[ruta])(q, cuerpo)
-        return self.responde({"error": "no such thing"}, codigo=404)
+        if ruta not in self.POSTS:
+            self.apunta(q, "post", ruta=ruta, estado=404, error="no such thing")
+            return self.responde({"error": "no such thing"}, codigo=404)
+        # Every write is recorded before it happens and judged after, so a
+        # request that never came back says so too — a handler that hangs or
+        # dies leaves a line with no verdict, which is itself the finding.
+        empezado = time.monotonic()
+        self._ultimo = None
+        try:
+            salida = getattr(self, self.POSTS[ruta])(q, cuerpo)
+        except Exception as e:  # noqa: BLE001  the log is the point
+            self.apunta(q, "post", ruta=ruta, error=f"{type(e).__name__}: {e}",
+                        cuerpo=cuerpo, ms=int((time.monotonic() - empezado) * 1000))
+            raise
+        self.apunta(q, "post", ruta=ruta, estado=self._ultimo,
+                    cuerpo=cuerpo if self._ultimo != 200 else _resumen_cuerpo(cuerpo),
+                    error=self._error, ms=int((time.monotonic() - empezado) * 1000))
+        return salida
 
     def g_estado(self, q):
         datos = self.ciudad(q)
@@ -871,6 +936,16 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             return self.responde({"error": "no such demo"}, codigo=404)
         return self.responde({**(demos.ficha(cual, eventos) or {}), "eventos": eventos})
 
+    def g_diario(self, q):
+        """The journal, for `doctor --log` and for anybody about to send it."""
+        try:
+            cuantas = max(1, min(2000, int(q.get("n", ["200"])[0])))
+        except ValueError:
+            cuantas = 200
+        return self.responde(
+            {"ruta": diario.ruta(self.ciudad(q)), "lineas": diario.lee(self.ciudad(q), cuantas)}
+        )
+
     def g_carpeta(self, q):
         """One folder, listed: what is in it, and what each thing is.
 
@@ -1323,8 +1398,23 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             return self.responde({"error": "this city has no owner card yet"}, codigo=409)
         nombre = " ".join(str(cuerpo.get("name") or "").split())
         slug = card.ventana(nombre)
-        if not nombre or not card.ventana_valida(slug):
+        # `card.ventana` falls back to the word `repo` when nothing in the name
+        # survives slugging — which is right for a repository whose folder is
+        # punctuation, and wrong here: a house called `///` would be created
+        # with the window `repo`, and the name a person reads would stop being
+        # the thing the city addresses. A name has to carry a letter or a digit.
+        legible = bool(re.search(r"[a-z0-9]", nombre.lower()))
+        if not nombre or not card.ventana_valida(slug) or not legible:
             return self.responde({"error": "an agent needs a plain name"}, codigo=400)
+        # A window slug is cut at 80 characters, so a longer name would be
+        # stored in full on the card and addressed by a truncated one — the
+        # name a person reads and the window it opens quietly stop being the
+        # same thing. Refuse rather than silently rename.
+        if len(nombre) > 80:
+            return self.responde(
+                {"error": "an agent's name has to fit in a window title: 80 characters"},
+                codigo=400,
+            )
         clase = str(cuerpo.get("kind") or workspace.CLASE_DEFECTO).strip().lower()
         if clase not in workspace.CLASES:
             return self.responde(
@@ -1419,6 +1509,24 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             }
         )
 
+    def p_diario(self, q, cuerpo):
+        """The browser's half of the log.
+
+        Half of what goes wrong here goes wrong in the page — a handler that
+        threw, a fetch that never came back, a button that did nothing. A log
+        that stops at the network boundary tells half the story, so the page
+        writes into the same file the server does, and one file answers "what
+        happened" instead of two that have to be lined up by hand.
+        """
+        diario.apunta(
+            self.ciudad(q),
+            "browser",
+            que=str(cuerpo.get("que") or "")[:120],
+            detalle=cuerpo.get("detalle"),
+            donde=str(cuerpo.get("donde") or "")[:200],
+        )
+        return self.responde({"ok": True})
+
     def p_agente(self, q, cuerpo):
         """Tune one agent from its character sheet: model, effort, runtime and
         avatar seed, written to the card keys the launcher already resolves. An

package/bin/test

@@ -22,7 +22,7 @@ if [ -d .git ] && [ -x .githooks/pre-commit ] \
     && printf '  pre-commit gate armed (core.hooksPath .githooks)\n'
 fi
 
-SUITES=(widgets card parcels domains busca arnes i18n serve seat cities channel connect committee live-feed runtime claude-runtime runtime-ui runtime-failures stress adapter benchmark demo contracts exit rutas cage broker evidencia admision pairing hall-protocol doctor security workspace avatar crecimiento atajos navegador actualiza desinstala launch)
+SUITES=(widgets card parcels domains busca arnes i18n diario serve seat cities channel connect committee live-feed runtime claude-runtime runtime-ui runtime-failures stress adapter benchmark demo contracts exit rutas cage broker evidencia admision pairing hall-protocol doctor security workspace avatar crecimiento atajos navegador actualiza desinstala launch)
 [ $# -gt 0 ] && SUITES=("$@")
 
 fallos=0
@@ -91,6 +91,7 @@ necesarios = ["bin/agents-city.js", "bin/hall", "bin/seat", "bin/city", "bin/dem
               "plugin/scripts/crecimiento.py",
               "plugin/scripts/reset.py", "plugin/scripts/desinstala.py",
               "plugin/scripts/demos.py", "plugin/scripts/arnes.py",
+              "plugin/scripts/diario.py",
               "plugin/channel/runtime/arnes.json", "plugin/scripts/capabilities.py",
               "plugin/scripts/deliberations.py",
               "plugin/scripts/runtime_processes.py",

package/bin/test-arnes.py

@@ -20,6 +20,7 @@ So there are two things to defend here, and the second is the hard one:
 import json
 import os
 import re
+import subprocess
 import sys
 import tempfile
 
@@ -119,12 +120,119 @@ def sin_deriva():
            arnes.banderas("codex") == "" and arnes.banderas("opencode") == "",
            f"codex={arnes.banderas('codex')!r}")
 
+    # And it survives a SHELL, which is what receives it.
+    #
+    # This is the check that was missing, and its absence cost every Claude
+    # window in a city. Emitted bare, `--settings {"a":"b","c":true}` is
+    # destroyed twice before Claude sees it: brace expansion splits it on the
+    # comma, quote removal eats the double quotes, and what arrives is
+    # `--settings {a:b}` — "Invalid JSON provided to --settings".
+    #
+    # Asserting that the string CONTAINS the right words could never have
+    # caught that. So this parses the line the way a shell does and reads the
+    # value back as JSON, which is the only claim that matters.
+    import shlex  # noqa: PLC0415
+
+    palabras = shlex.split(arnes.banderas("claude"))
+    afirma("· the flags survive shell parsing as separate words",
+           "--settings" in palabras and "--disallowed-tools" in palabras, str(palabras))
+    valor = palabras[palabras.index("--settings") + 1]
+    try:
+        ajustes = json.loads(valor)
+    except json.JSONDecodeError as e:
+        ajustes = None
+        afirma("· and the settings value is still JSON afterwards", False, f"{valor!r}: {e}")
+    if ajustes is not None:
+        afirma("· and the settings value is still JSON afterwards", True, "")
+        comprueba("· with the cross-session path closed",
+                  ajustes.get("crossSessionInbound"), "refuse")
+        afirma("· and every declared settings key inside it",
+               all(t["clave"] in ajustes
+                   for t in arnes.declaracion()["claude"]["trato"]
+                   if t.get("rinde") == "settings"),
+               str(ajustes))
+    # A real shell, not just a parser: brace expansion is the half `shlex`
+    # forgives, and it is the half that broke.
+    import subprocess  # noqa: PLC0415
+
+    r = subprocess.run(
+        ["bash", "-c", 'set -- ' + arnes.banderas("claude") + '; printf "%s\n" "$@"'],
+        capture_output=True, text=True,
+    )
+    entregado = [l for l in r.stdout.split("\n") if l]
+    comprueba("· a real shell hands over exactly four words", len(entregado), 4)
+    try:
+        json.loads(entregado[1])
+        afirma("· and the second is the settings, intact", True, "")
+    except json.JSONDecodeError as e:
+        afirma("· and the second is the settings, intact", False, f"{entregado!r}: {e}")
+
 
 def _es_metodo_declarado(aguja, declaradas):
     """`approvalPolicy` declared, read through a method of the same name."""
     return any(aguja.lower() == d.lower() for d in declaradas)
 
 
+def valores_que_no_sobrevivirian(tmp):
+    """Values that a shell would eat, or run.
+
+    The happy checks above prove today's declaration survives. They cannot
+    prove the NEXT one will: the values there are mild strings, and the bug
+    that broke every Claude window was a comma. The day somebody declares a
+    value with a space in it, or a quote, this has to hold — and if it does
+    not, it must fail here rather than in a person's terminal.
+
+    The last two are not a formatting concern. `$(...)` and backticks in an
+    unquoted argument are executed by the shell, and this declaration is read
+    from a file: a value that runs a command is a value that runs somebody
+    else's command.
+    """
+    print("  values a shell would eat, or run")
+    testigo = os.path.join(tmp, "ejecutado")
+    hostiles = {
+        "conEspacio": "dos palabras",
+        "conComillas": 'dice "hola" y \'adios\'',
+        "conLlaves": "{a,b}",
+        "conPuntoYComa": "uno; echo dos",
+        "conDolar": "$HOME y ${OTRO}",
+        "conSustitucion": f"$(touch {testigo})",
+        "conAcentoGrave": f"`touch {testigo}`",
+    }
+    real = arnes.declaracion
+    arnes.declaracion = lambda: {
+        "claude": {
+            "trato": [
+                {"clave": k, "valor": v, "via": "x", "porque": "y" * 30, "rinde": "settings"}
+                for k, v in hostiles.items()
+            ]
+        }
+    }
+    try:
+        linea = arnes.banderas("claude")
+    finally:
+        arnes.declaracion = real
+
+    # A real shell, because `shlex` forgives what bash does not.
+    r = subprocess.run(
+        ["bash", "-c", "set -- " + linea + '; printf "%s\\n" "$@"'],
+        capture_output=True, text=True,
+    )
+    entregado = [l for l in r.stdout.split("\n") if l]
+    afirma("· a hostile declaration still comes out as two words",
+           len(entregado) == 2 and entregado[0] == "--settings",
+           f"{entregado!r} from {linea!r}")
+    afirma("· nothing in it was executed on the way",
+           not os.path.exists(testigo),
+           f"{testigo} exists: a declared value ran a command")
+    try:
+        vuelta = json.loads(entregado[1]) if len(entregado) > 1 else {}
+    except json.JSONDecodeError as e:
+        vuelta = {}
+        afirma("· and it is still JSON on the other side", False, f"{entregado[1]!r}: {e}")
+    for clave, valor in hostiles.items():
+        comprueba(f"· {clave} arrives exactly as declared", vuelta.get(clave), valor)
+
+
 def lo_que_hay_en_el_disco():
     print("  it reads the machine, and admits what it cannot read")
     casa = tempfile.mkdtemp()
@@ -183,6 +291,7 @@ def el_informe():
 def main():
     la_declaracion()
     sin_deriva()
+    valores_que_no_sobrevivirian(tempfile.mkdtemp())
     lo_que_hay_en_el_disco()
     el_informe()
     return resumen("arnes")

package/bin/test-channel.py

@@ -22,6 +22,37 @@ CHANNEL = os.path.join(RAIZ, 'plugin', 'channel', 'run.sh')
 CLIENT = os.path.join(RAIZ, 'plugin', 'channel', 'client.js')
 
 
+def espera_avisos(bus, quieto=0.6, tope=10):
+    """The seat's wake-ups, once they have arrived AND stopped arriving.
+
+    Reading `bus.mensajes` at a fixed moment samples a race, and a sample lies
+    in both directions: it saw zero on a loaded Linux runner and failed a
+    working product, and on a slow one it could see two of a hundred and pass a
+    broken one. Both halves of the assertion need the burst to be over — the
+    lower bound needs them to have arrived, the upper bound needs no more to be
+    coming.
+
+    So: wait for the first, then wait until none has appeared for `quieto`.
+    Quiescence, not a guess at how long a hundred arrivals take.
+    """
+    def cuantos():
+        return sum(1 for m in bus.mensajes
+                   if m.get('method') == 'notifications/claude/channel')
+
+    limite = time.monotonic() + tope
+    bus.espera(lambda m: m.get('method') == 'notifications/claude/channel', segundos=tope)
+    ultimo, estable = cuantos(), time.monotonic()
+    while time.monotonic() < limite:
+        time.sleep(0.05)
+        ahora = cuantos()
+        if ahora != ultimo:
+            ultimo, estable = ahora, time.monotonic()
+        elif time.monotonic() - estable >= quieto:
+            break
+    return [m for m in bus.mensajes
+            if m.get('method') == 'notifications/claude/channel']
+
+
 def espera(condicion, segundos=8):
     limite = time.monotonic() + segundos
     while time.monotonic() < limite:
@@ -398,8 +429,9 @@ def main():
                'alice/home' in texto(roster)
                and 'alice/ghost' not in texto(roster)
                and '"online": true' in texto(roster), texto(roster))
-        road_notices = [m for m in b.mensajes
-                        if m.get('method') == 'notifications/claude/channel']
+        # Waited for, not sampled. Reading the list at a fixed moment saw zero
+        # on a loaded runner and failed a product that was working.
+        road_notices = espera_avisos(b)
         # Coalesced, not exactly-one. The property is that a hundred arrivals
         # do not become a hundred interruptions; whether the window happens to
         # close once or twice mid-burst is the machine's business, and asserting